PHP2Shell: RCE via stale global state

Summary

Unauthenticated remote code execution through a use-after-free pattern. Request-owned state can survive in worker globals after the request heap is freed, and a later request on the same worker may act on that stale state.

Component: PHP core (php-src). Disclosed: 21 October 2026. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. GitHub / PHP Security Team PHP Group CERT-EU

Fixed versions

Fixed upstream in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Restart workers after updating so the old binary is not still serving requests. PHP Group GitHub / PHP Security Team

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• The producer and consumer requests must be handled by the same PHP worker, according to the advisory.
• The confirmed session path requires session.upload_progress.enabled to remain at its default-on setting.
• The confirmed fatal-error-backtrace path applies to PHP 8.5.
• PHP describes multiple trigger strategies; the confirmed paths are not the full set of variants.

Exploitation status

Attempts have been reported by multiple vendors, including activity that abused the session upload-progress path. No confirmed successful mass compromise had been publicly established at this page's verification time.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

What the flaw is

PHP keeps several pieces of state in process-global variables. Some of those variables temporarily point into the memory owned by the current request. The advisory says that in some scenarios this state is not reset correctly, or is repopulated after a reset, and can still refer to request memory after that memory has been freed.

A later request handled by the same worker may read or branch on the stale value before normal initialisation replaces it. The advisory describes this as a use-after-free and says heap manipulation can produce full remote code execution. The confirmed early consumers are INI diagnostics and session upload progress.

Why worker reuse matters

The producer request and the consumer request must reach the same worker. That condition is why a simple single-request scanner may not prove or disprove exposure, and why PHP-FPM operators sometimes use pm.max_requests=1 as a temporary way to break the reuse pattern. That setting has availability and performance costs and is not a complete fix.

Disabling session upload progress removes the confirmed session path. Setting fatal_error_backtraces=0 on PHP 8.5 removes the confirmed fatal-backtrace path. Neither removes other variants. PHP's advisory is explicit that there is no complete generic configuration fix.

Fix and interim controls

Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, then restart every PHP worker. A package upgrade that leaves old workers running does not apply the fix to traffic. Managed platforms must confirm the runtime their pool actually loads.

If patching cannot happen immediately, apply the settings in php.ini, the FPM pool or server configuration so they take effect before request parsing. PHP warns not to rely on ini_set() or .user.ini. Hiding diagnostics with error_reporting, display_errors or @ does not close the path. Also fix attacker-reachable fatal errors and timeouts, because those can feed the confirmed paths.

Verification status

The flaw, patched releases and interim controls are confirmed by the PHP advisory, the GitHub advisory and PHP's release announcement. Wiz demonstrated laboratory exploitation against multiple CMS container images. Vendor reports of attack attempts describe attempts, not confirmed compromises of specific sites.

The CVE was not in the CISA KEV JSON catalog version downloaded for this page. KEV absence is a statement about that catalog at that time.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.